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DETAILED ACTION 

1. Claims 1-16 are pending in the application. 

Drawings 

2. The drawings are objected to under 37 CFR 1 .83(a). The drawings must show 
every feature of the invention specified in the claims. Drawings (Figs 1-3) on record do 
not show each of the "Internet link" connected to the Internet and how "all of the 
packets flowing through Internet links" are collected for measurement as recited in 
claims 1 and 9. Therefore, the links connecting to the Internet and collection of all of the 
packets flowing through the links must be clearly shown in the drawings (Figs. 1-3) or 
the feature(s) canceled from the claim(s). No new matter should be entered. 

Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in 
reply to the Office action to avoid abandonment of the application. Any amended 
replacement drawing sheet should include all of the figures appearing on the immediate 
prior version of the sheet, even if only one figure is being amended. The figure or figure 
number of an amended drawing should not be labeled as "amended." If a drawing figure 
is to be canceled, the appropriate figure must be removed from the replacement sheet, 
and where necessary, the remaining figures must be renumbered and appropriate 
changes made to the brief description of the several views of the drawings for 
consistency. Additional replacement sheets may be necessary to show the renumbering 
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of the remaining figures. Each drawing sheet submitted after the filing date of an 
application must be labeled in the top margin as either "Replacement Sheet" or "New 
Sheet" pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, 
the applicant will be notified and informed of any required corrective action in the next 
Office action. The objection to the drawings will not be held in abeyance. 

Claim Objections 



3. Claim 16 is objected to under 37 CFR 1 .75(c) as being in improper form because 
a multiple dependent claim recites an improper claim language "traffic analysis of 
method of claims 9 through 15", which is unacceptable. See MPEP § 608.01 (n) for 
multiple dependent claims. Appropriate correction is required to claim 16. 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

The claimed invention in claim 16 is directed to non-statutory subject 
matter. The use of phrase "recording medium on which a traffic analysis method 
of claims 9 through is recorded using program codes that are operated in a 
computer" does not comply with the 101 interim guidelines (please refer to page 



Application/Control Number: 10/693,416 Page 4 

Art Unit: 2616 

52 of the interim guidelines). In order for a computer program or software 
instructions to be statutory it must be embodied in a computer readable medium. 
Also on page 8 of the specification, the medium is defined to include a carrier 
wave, thus claim 16 is nothing but a signal (carrier wave) claim. 
Appropriate correction is required to claim 16. 

Claim Rejections - 35 USC §112 



5. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

6. Claims 1 ,9 is rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. In line 2 of claim 1 the phrase (s) "a plurality of 
measurement devices that collect all of packets flowing through Internet links..." fails to 
particularly point out and distinctly claim the subject matter. It is not clear from the claim 
or the specification as to how each of the "Internet link" is connected to the Internet 
and how "all of the packets flowing through Internet links" are collected for 
measurement. Appropriate corrections are required to claims 1,9. 

Regarding claims 3-5, in claim 3 the phrase "such as" renders the claim 
indefinite because it is unclear whether the limitations following the phrase are part of 
the claimed invention. Appropriate corrections are required to claims 3-5. 
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Claim Rejections - 35 USC § 102 

7. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another 
filed in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United States 
and was published under Article 21 (2) of such treaty in the English language. 

8. Claims 1-15 are rejected under 35 U.S.C. 102(e) as being anticipated by Veres et 
al. [US Pat: 6,807,156]. 

Regarding claim 1, Veres et al in the invention of "Scalable Real-Time Quality of 
Service Monitoring and Analysis of Service Dependent Subscriber Satisfaction in IP 
Networks" disclosed a traffic measurement system (Figs 3-4) comprising: a plurality of 
measurement devices (probes or processes monitoring traffic at points A & B of 
Fig 3) that collect all of packets flowing through Internet links (col 8, lines 51-65), 
extract (capture) traffic data required to analyze traffic from the collected packets (item 
120 of Fig 4), and process the extracted data into predetermined flow types 
(microflows, col 8,lines 66-67,col 9, lines 1-5); and an analysis server that identifies 
applications (subscriber identification and applications) of traffic by analyzing the 
traffic data transferred from the plurality of measurement devices as a whole (col 9, 
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lines 6-10), classifies the identified applications into predetermined traffic types, and 
outputs the classification result (col 9, lines 10-12). 

Regarding claim 2, Veres et al disclosed that a plurality of time receiving devices 
that extract time signals from a GPS satellite or a CDMA base station to synchronize the 
times of the plurality of measurement devices (col 2, lines 50-53). 

Regarding claim 3, Veres et al disclosed each of the plurality of measurement 
devices comprises: a packet collection unit that collects the packets flowing through the 
Internet lines from router connection lines and records the collection times of the 
packets (packet filtering process, item 120 of Fig 4, col 8, lines 66-67, col 9, lines 
1-5); a flow generation unit (item 140 of Fig 4) that generates flows using the packets 
having the same data (microflow processor, item 130 of Fig 4), such as a target 
address, a protocol, and a port number (col 6, lines 21-26), from the packets collected 
by the packet collection unit (captured packets stored in shared memory for flow 
identification, col 9, lines 6-13), extracts data required for detailed analysis of the 
applications after analyzing the contents of the packets, and stores the extracted data 
according to the flow (database of monitored microflows); and a transfer unit that 
transfers the data stored in the flow generation unit to the analysis server according to a 
predetermined time interval (col 9, lines 14-45). 

Regarding claims 4-5, Veres et al disclosed that the packet collection unit 
collects the packets by using one of tapping (probing or sniffing), port mirroring 
(application dependent port, FTP, HTTP, TCP, col 3, lines 18-33) and signal 
distribution and the data required for detailed analysis of the applications are application 
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signatures (service dependent applications, RTP, FTP, WWW etc.,) for identifying 
the applications in payload of the packets (col 4, lines 44-61). 

Regarding claim 6, Veres et al disclosed wherein the analysis server (microflow 
processor, item 130 of Fig 4) comprises: a data receiving unit (network interface and 
shared memory, item 110 of Fig 4, col 9, lines 14-29) that receives the packet data 
from the plurality of measurement devices (probes or processes monitoring traffic at 
points A & B of Fig 3); a traffic analysis unit (prefiltering processor, item 120 of Fig 
4) that analyzes the data provided from the plurality of measurement devices via the 
data receiving unit as a whole (col 9, lines 30-45), and classifies the applications into 
the traffic types (WWW, FTP, Streaming Media, VoIP application dependent 
module, item 140 of Fig 4, col 9, lines 5-13) according to the analysis result; a data 
storing unit (database of monitored subscribers/microflows, Fig 4) that stores the 
traffic analysis result (delay, throughput, efficiency, packet loss etc.,) of the traffic 
analysis unit; and a user interface that displays the traffic analysis result stored in the 
data storing unit to a user after processing the traffic analysis result into various types 
desired by the user (user reports, col 4, lines 44-67). 

Regarding claim 7, Veres et al disclosed that the analysis server further 
comprises a report output unit (report, item 140 of Fig 4) that processes the traffic 
analysis result from the traffic analysis unit into a predetermined report type (col 5, 
lines 31-67) and stores the processed data in the data storing unit (database of 
monitored subscribers/microflows, Fig 4), and the report is displayed (microflow 
record) to the user through the user interface (col 11, lines 23-29). 
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Regarding claim 8, Veres et al disclosed that the traffic types comprise: a first 
traffic type (TCP) whose applications are identified using only TCP/UDP port numbers 
(col 9, lines 30-37); a second traffic type (IP) whose applications are identified by 
collecting application headers and application signatures (service dependent 
applications, RTP, FTP, WWW etc.,) that are included in payloads of the packets (col 
9, lines 31-33); a third traffic (UDP) type whose applications are identified by extracting 
application data from the second traffic type (prefilteration), since application data is 
not included in reverse traffic of the second traffic type (col 9, lines 46-54); a fourth 
traffic type (RTP) whose applications are assigned predetermined port numbers are 
identified based on application signature of other flows since the port numbers are 
exchanged through an other control flows; and a fifth traffic type (VoIP, item 140 of Fig 
4) whose applications are not classified into the first through the fourth traffic types (col 
9, lines 60-67). 

Regarding claim 9, Veres et al disclosed a traffic analysis method performed in a 
traffic measurement system (probes or processes monitoring traffic at points A & B 
of Fig 3) that collects packets flowing through Internet links (col 8, lines 51-67), 
analyzes traffic, and identifies the applications of the packets (col 9, lines 1-29), the 
method comprising: classifying a first traffic type (TCP) whose applications are identified 
using only port numbers included in flow data that is processed into a predetermined 
type (col 6, lines 21-26); classifying a second traffic type (IP) whose applications are 
identified by collecting application headers and application signature (application 
identifiers) that are included in payload of the packets, from the flow data remaining 
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after the first traffic type is classified (col 9, lines 30-41); classifying a third traffic type 
(UDP) whose applications are identified by analyzing the flow data remaining after the 
second traffic type is classified (col 9, lines 1-4) and reverse-direction flow data (both 
directions of traffic stream) of the flow that are measured at different points as a 
whole (col 10, lines 50-57); classifying a fourth traffic type (RTP) whose applications 
are identified by analyzing the flow data remaining after the third traffic type is classified 
and flow data measured at different points, since port numbers for the applications are 
not predetermined (col 10, lines 62-67, col 11, lines 1-2); and classifying a fifth traffic 
type (VoIP, item 140 of Fig 4) whose applications cannot be identified using the flow 
data remaining after the fourth traffic type is classified (col 9, lines 60-67). 

Regarding claim 1 0, Veres et al disclosed the flow data is packets having the 
same target address (destination port), the same protocol (FTP), and the same port 
number among the packets flowing through the Internet lines (col 11, lines 34-45). 

Regarding claim 11, Veres et al disclosed determining whether identification data 
of the fourth traffic type (RTP) is present in traffic included classified into the first traffic 
type (TCP) and extracting and storing the application signature of the fourth traffic type, 
after classifying the first traffic type (col 9, lines 30-37, Fig 4). 

Regarding claims 12-13, Veres et al disclosed extracting and storing the 
application signature of traffic classified into the third traffic type (UDP) when traffic 
classified into the second traffic type (IP) is backward traffic of traffic classified into the 
third traffic type, after classifying the second traffic type (col 10, lines 50-67) and 
determining whether identification data of the fourth traffic type (RTP) is present in traffic 
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classified into the second traffic type and extracting and storing the application signature 
(service dependent applications, RTP, FTP, WWW etc.,) of the fourth traffic type, 
after classifying the second traffic type (col 11, lines 1-12, Fig 4). 

Regarding claims 14-15, Veres et al disclosed taking statistics on traffic classified 
into the fifth traffic type (VolP/RTP for voice) in order to monitor the applications and 
storing the statistics result, after classifying the fifth traffic type (col 15, lines 49-55) and 
processing the classified traffic types into predetermined report types desired by a user 
and storing or providing the processed report through a user interface, after classifying 
the fifth traffic type (col 15, lines 57-63, Fig 8c). 

Conclusion 

9. Any inquiry concerning this communication or earlier communications should be 
directed to the attention to Venkatesh Haliyur whose phone number is 571-272-8616. 
The examiner can normally be reached on Monday-Friday from 9:00AM to 5:00 PM. If 
attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Wing Chan can be reached @ (571)-272-7493. Any inquiry of a general 
nature or relating to the status of this application or proceeding should be directed to the 
group receptionist whose telephone number is (571)-272-2600 or fax to 571-273-8300. 

10. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
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applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov . Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-21 7-91 97(toll-free). 
Venkatesh Haliyur 

Patent Examiner r WING CHAN 

DL or/tt/o; SUPERVISORY went examiner 



